The present invention relates generally to monitoring the access of sensitive data by users, and more particularly to generating false data for suspicious users.